Understanding Linux permissions

Linux permissions decide who can read, modify or execute a file. Most application incidents come from a setting that is too permissive or too restrictive: a site that cannot write to its uploads folder, or a configuration file readable by everyone.

Read permissions

ls -l /var/www/site/index.php
stat /var/www/site/index.php
namei -l /var/www/site/index.php

A typical line:

-rw-r--r-- 1 www-data www-data 1024 Nov  7 10:00 index.php

The first character is the type (- file, d directory, l link). The next nine form three groups of three: owner, group, others. rw- means read and write without execute. namei -l prints permissions for every directory in the path, which often reveals the real blocker.

Numbers add up: read 4, write 2, execute 1. On a directory, execute means "traverse": without it, files inside cannot be reached even if they are readable.

Change them

sudo chmod 644 file.conf
sudo chmod 755 /var/www/site
sudo chmod u+x script.sh
sudo chmod g-w,o-rwx data.txt
sudo chown utilisateur:groupe file
sudo chgrp www-data file

For a web tree, treat directories and files separately:

sudo find /var/www/site -type d -exec chmod 755 {} +
sudo find /var/www/site -type f -exec chmod 644 {} +

chmod -R 755 on files makes images executable. A badly targeted chmod -R can also remove execute permission from directories and break the site.

umask and default permissions

umask defines rights removed from new files and directories:

umask
umask -S

A 022 umask gives 755 to directories and 644 to files. A 027 umask gives 750 and 640, stricter. For a service, set UMask=0027 in its systemd unit.

Special bits and pitfalls

• setuid (4000) runs a program with its owner's rights; avoid it except for intended system tools.
• setgid (2000) on a directory makes new files inherit the group.
• The sticky bit (1000) on /tmp (1777) stops users from deleting each other's files.
• ACLs (getfacl, setfacl) add fine-grained rights.

Why avoid chmod 777: any user, including a compromised process, can modify or replace the file. On a website, that lets a flaw install a persistent shell. The web server needs read access, not write everywhere; only the uploads or cache directory should be writable, preferably by a dedicated user.

Verify

stat -c '%a %U:%G %n' file
namei -l /var/www/site/index.php
sudo -u www-data test -r /var/www/site/index.php && echo readable